I have build Bro IDS from source code. It's successfully installed
user@ubuntu:~$ bro -v
bro version 2.4.1
I am running bro in VM. My Ethernet interface in ens33 instead of eth0. After updating node.cfg to my custom interface i.e. ens33 , i am still unable to start bro.
node.cfg
[bro]
type=standalone
host=localhost
interface=ens33
When i start broctl, i see following error logs
Bro 2.4.1
Linux 4.4.0-96-generic
==== No reporter.log
==== stderr.log
fatal error: problem with interface eth0 (eth0: SIOCETHTOOL(ETHTOOL_GET_TS_INFO) ioctl failed: No such device)
==== stdout.log
max memory size (kbytes, -m) unlimited
data seg size (kbytes, -d) unlimited
virtual memory (kbytes, -v) unlimited
core file size (blocks, -c) unlimited
==== .cmdline
-i eth0 -U .status -p broctl -p broctl-live -p standalone -p local -p bro local.bro broctl broctl/standalone broctl/auto
==== .env_vars
PATH=/usr/bin:/usr/share/broctl/scripts:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
BROPATH=/var/spool/bro/installed-scripts-do-not-touch/site::/var/spool/bro/installed-scripts-do-not-touch/auto:/usr/share/bro:/usr/share/bro/policy:/usr/share/bro/site
CLUSTER_NODE=
==== .status
TERMINATED [atexit]
==== No prof.log
==== No packet_filter.log
==== No loaded_scripts.log
What i can understand from logs is that broctl is unable to read the updated node.cfg,because it is using the wrong interface. Now I need to know what else changes do I need to make in order to start bro without crash?
You should edit config file in /etc/bro/node.cfg, and change eth0 to ens33